NPS-OR-03-002 


NAVAL  POSTGRADUATE  SCHOOL 
Monterey,  California 


OPTIMIZING  ELECTRIC  GRID  DESIGN  UNDER 
ASYMMETRIC  THREAT 

by 

J.  Salmeron  and  K.  Wood,  Naval  Postgraduate  School 
R.  Baldick,  University  of  Texas  at  Austin 

February  2003 


Approved  for  public  release;  distribution  is  unlimited 

Prepared  for:  U.S.  Department  of  Justice  Office  of  Justice  Programs  and  Office  of  Domestic  Preparedness, 
under  the  aegis  of  the  Naval  Postgraduate  School  Homeland  Security  Leadership  Development  Program 


20030310  Qtf 


NAVAL  POSTGRADUATE  SCHOOL 
MONTEREY,  CA  93943-5000 


RADM  David  R.  Ellison  Richard  Elster 

Superintendent  Provost 


This  report  was  prepared  for  the  U.S.  Department  of  Justice  Office  of  Justice  Programs 
and  Office  of  Domestic  Preparedness. 


Reproduction  of  all  or  part  of  this  report  is  authorized. 


This  report  was  prepared  by: 


JAVIER  SALMERON 
Research  Assistant  Professor  of 
Operations  Research 


Associate  Professor  of 


Electrical  Engineering 

The  University  of  Texas  at  Austin 


Associate  Chairman  for  Research 


Department  of  Operations  Research 


Released  by: 


DAVID  W.  NETZER 

Associate  Provost  and  Dean  of  Research 


REPORT  DOCUMENTATION  PAGE 


Form  Approved  OMB  No.  0704-0188 


Public  reporting  burden  for  this  collection  of  information  is  estimated  to  average  1  hour  per  response,  including 
the  time  for  reviewing  instruction,  searching  existing  data  sources,  gathering  and  maintaining  the  data  needed,  and 
completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any 
other  aspect  of  this  collection  of  information,  including  suggestions  for  reducing  this  burden,  to  Washington 
headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite 
1204,  Arlington,  VA  22202-4302,  and  to  the  Office  of  Management  and  Budget,  Paperwork  Reduction  Project 
(0704-0188) WashingtonDC 20503.  ^  _ _ _ _ 

1.  AGENCY  USE  ONLY  (Leave  blank)  I  2.  REPORT  DATE  I  1.  AGENCY  USE  ONLY  (Leave  blank) 


5.  FUNDING  NUMBERS 
2002-GT-R-057 


8.  PERFORMING 
ORGANIZATION  REPORT 
NUMBER 

NPS-OR-03-002 


10.  SPONSORING/MONITORING 
AGENCY  REPORT  NUMBER 


4.  TITLE  AND  SUBTITLE:  Optimizing  Electric  Grid  Design  Under  Asymmetric 
Threat  _  * 


6.  AUTHOR(S)  Javier  Salmeron,  Kevin  Wood  and  Ross  Baldick 


7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

Department  of  Computer  Science 
Naval  Postgraduate  School 
833  Dyer  Road,  Code  CS 

Monterey,  CA  93943-5118 _  — 


9.  SPONSORING  /MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES) 

U.S.  Department  of  Justice 

Office  of  Justice  Programs 

810  Seventh  St.,  NW 

Washington,  DC  20531 


11.  SUPPLEMENTARY  NOTES  The  views  expressed  in  this  thesis  are  those  of  the  author  and  do  not  reflect  the  official 
Dolicv  or  position  of  the  Department  of  Defense  or  the  U.S .  Government.  — 


12a.  DISTRIBUTION  /  AVAILABILITY  STATEMENT  1 12b.  DISTRIBUTION  CODE 

Approved  for  public  release;  distribution  is  unlimited _ _ _ I 


13.  ABSTRACT  (Maximum  200  words.) 

This  research  develops  analytical  techniques  to  help  improve  the  security  of  electric  power  grids  subject  to 
disruptions  caused  by  terrorist  attacks  (and  even  by  natural  disasters).  Our  new  bilevel  mathematical  models  and 
optimization  techniques  identify  critical  system  components  (e.g.,  transmission  lines,  generators,  transformers,  and 
other  power  system  elements)  by  creating  maximally  disruptive  attack  plans  for  terrorists  who  are  assumed  to  have 
limited  offensive  resources.  Results  for  standard,  reliability-benchmark,  test  networks  are  presented.  We  also 
discuss  trilevel  models  for  actually  selecting  a  set  of  budget-limited  system  upgrades  that  minimizes  the  potential 
for  disruption.  -  - - 


14.  SUBJECT  TERMS  15.  NUMBER  OF 

Homeland  Security,  Electric  Power  Grids,  Network  interdiction.  PAGES 

38 

16.  PRICE  CODE 


17.  SECURITY 
CLASSIFICATION  OF 
REPORT 

Unclassified 


NSN  7540-01-280-5500 


18.  SECURITY 
CLASSIFICATION  OF  THIS 
PAGE 

Unclassified 


17.  SECURITY 
CLASSIFICATION  OF 
REPORT 

Unclassified 


18.  SECURITY 
CLASSIFICATION 
OF  THIS  PAGE 

Unclassified 


Standard  Form  298  (Rev.  2-89) 
Prescribed  by  ANSI  Std.  239-18 


OPTIMIZING  ELECTRIC  GRID  DESIGN  UNDER  ASYMMETRIC  THREAT 

by 


Javier  Salmeron  and  Kevin  Wood 
Operations  Research  Department, 

Naval  Postgraduate  School,  Monterey,  CA  93943-5001 

Ross  Baldick 

Department  of  Electrical  Engineering 
University  of  Texas  at  Austin,  Austin,  TX,  78712-1084 

Abstract 

This  research  develops  analytical  techniques  to  help  improve  the  security  of  electric 
power  grids  subject  to  disruptions  caused  by  terrorist  attacks  (and  even  by  natural 
disasters).  Our  new  bilevel  mathematical  models  and  optimization  techniques  identify 
critical  system  components  (e.g.,  transmission  lines,  generators,  transformers,  and  other 
power  system  elements)  by  creating  maximally  disruptive  attack  plans  for  terrorists  who 
are  assumed  to  have  limited  offensive  resources.  Results  for  standard,  reliability- 
benchmark,  test  networks  are  presented.  We  also  discuss  trilevel  models  for  actually 
selecting  a  set  of  budget-limited  system  upgrades  that  minimizes  the  potential  for 
disruption. 


TABLE  OF  CONTENTS 


1.  INTRODUCTION . 1 

2.  OBJECTIVE . 2 

3.  APPROACH . 3 

3.  l  Power-flow  model . 4 

3.2  Interdiction  model . 5 

3.3  Interdiction  algorithm . 7 

4.  RESULTS . 13 

4. 1  Implementation . 13 

4.2  Test  case  description . 13 

4.3  Interdiction  plans . 13 

5.  VALUE  OF  THE  RESEARCH  TO  HOMELAND  SECURITY . 19 

6.  FUTURE  WORK . 2® 

6. 1  Introduction . 20 

6.2  Functionality  and  Modeling . 20 

6.3  Algorithms . 21 

6.4  Data . 22 

6.5  Extensions . 22 

REFERENCES . 24 

APPENDIX:  TABLES  OF  RESULTS . 25 

INITIAL  DISTRIBUTION  LIST . 33 


l 


1.  INTRODUCTION 


This  document  reports  on  the  first  phase  of  the  research  entitled  “Homeland  Security  Research 
And  Technology  Proposal  (Optimizing  Electric  Grid  Design  Under  Asymmetric  Threat),”  which 
is  sponsored  by  the  U.S.  Department  of  Justice,  Office  of  Justice  Programs  and  Office  of 
Domestic  Preparedness  (2002-GT-R-057). 

This  research  begins  an  effort,  spanning  several  years,  aimed  at  developing  new  optimization 
models  and  methods  for  planning  expansion  and  enhancements  of  electrical  power  grids  that 
improve  robustness  to  potential  disruptions  caused  by  natural  disasters,  sabotage  and,  especially, 
terrorist  attacks.  The  research  reported  here  enables  identification  of  critical  grid  components 
(which  may  include  transmission  lines,  generators,  transformers,  and  other  power  system 
elements)  by  identifying  maximally  disruptive,  coordinated,  terrorist  attacks  on  an  electrical 
power  grid.  We  report  results  obtained  using  our  techniques  on  standard,  reliability-benchmark, 
test  networks. 

The  document  is  organized  as  follows:  Section  2  presents  an  overview  of  the  project’s  objectives. 
Section  3  describes  our  approach  to  the  problem,  including  the  mathematical  formulation  of 
models  and  outlines  of  algorithms.  Section  4  reports  preliminary  results  of  our  models  and 
methods  applied  to  two  medium-size  power  grids  which  are  standard  test-bed  examples.  Section 
5  summarizes  the  value  of  this  research  with  respect  to  the  original  call  for  proposals.  Finally, 
Section  6  explains  future  goals  and  proposes  extensions  of  this  research. 
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2.  OBJECTIVE 


The  United  States’  electrical  power  system  is  critical  to  the  country’s  economy  and  security.  The 
system’s  vulnerability  to  natural  disasters  or  physical  attacks  has  been  recognized,  but  this 
vulnerability  has  been  increasing  in  recent  years  because:  (a)  Infrastructure  has  not  expanded  as 
quickly  as  demand  has,  thereby  reducing  the  “cushion”  available  when  system  components  fail, 
and  (b)  the  probability  of  terrorist  attacks  has  increased.  Our  project  develops  new  mathematical 
models  and  optimization  methods  for  robust  planning  of  electrical  power  grids,  focusing  on 
security  and  reliability  with  special  emphasis  on  potential  disruptions  caused  by  terrorist  attacks. 
As  an  incentive  to  spend  the  money  necessary  to  make  electric  power  grids  more  robust,  we  also 
want  to  demonstrate  secondary  economic  benefits. 

We  refer  to  our  proposal  [Salmeron  and  Wood  2002]  and  references  therein  for  detailed 
background  on  the  problem  of  electric  power-grid  vulnerability.  In  that  document,  we  establish 
short-  find  long-term  goals  for  this  research  and  its  critical  importance.  The  key  motivation  is: 
“The  nation’s  electric  power  systems  must  clearly  be  made  more  resilient  to  terrorist  attack” 
[Committee  on  Science  and  Technology  for  Countering  Terrorism  2002]. 

In  this  initial  research  on  the  problem,  we  develop  models  and  algorithms  that  can  identify  sets  of 
system  components  whose  proper  functioning  is  key  to  meeting  demand  for  electrical  power.  We 
focus  on  optimal  interdiction,  i.e.,  attack,  of  electric  power  grids,  subject  to  limited  interdiction 
resources.  “Optimality”  implies  that  the  attack  causes  the  largest  possible  disruption;  “limited 
resources”  implies  a  set  of  combined  attacks  on  system  components  that  terrorists  might 
reasonably  carry  out  simultaneously.  By  studying  how  to  attack  power  grids,  we  will  ultimately 
understand  how  to  protect  them.  By  considering  the  largest  disruptions  that  might  be  caused  by  a 
coordinated  set  of  attacks,  our  proposed  protection  plans  will  be  appropriately  conservative.  The 
discussion  emphasizes  terrorist  attacks,  but  our  techniques  are  also  applicable  to  improving  the 
security  of  electric  power  grids  subject  to  natural  disasters. 
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3.  APPROACH 


We  have  developed  a  preliminary  interdiction  model  and  an  algorithm  to  solve  the  problem 
approximately.  The  interdiction  model  is  a  max-min  (Mm)  problem: 

(Mm) :  max  min  cy 

Se  A 

t  lf(y,S)<b 

s.t.  < 

l  y^o 

For  a  given  interdiction  plan  8 ,  the  inner  problem  is  a  power-flow  model  that  minimizes 
generation  costs  plus  the  penalty  associated  with  unmet  demand,  together  denoted  by  cy.  Here,  y 
represents  generation  outputs,  phase  angles  and  power  flows,  as  well  as  unmet  demand,  i.e.,  the 
amount  of  “load  shed.”  The  outer  maximization  attempts  choose  the  most  disruptive,  resource- 
constrained  interdiction  plan  8  e  A ,  where  A  is  a  discrete  set.  In  this  model, /will  correspond  to 
a  set  of  functions  that  are  nonlinear  in  (y,  8) .  In  our  preliminary  DC  model  of  the  inner  problem, 

fly)  (i.e.,  f(y,8)  for  a  given  fixed  8 ),  is,  however,  linear  in  y.  However,  when  all  the  features 
of  a  power-flow  model  such  as  reactive  power  flows  and  losses  are  considered,  fly)  becomes 
nonlinear  even  for  a  fixed  5  . 

At  futures  stages  of  our  research  (see  Section  6)  we  will  investigate: 

•  Linear  approximations  of  the  (Mm)  problem,  (L-Mra)  that  have  the  form: 

(LMm) :  max  min  cy 

Se  A 

[Ay<B8 
s.t.  < 

\  y>0 

which  are  amenable  to  exact  decomposition  methods, 

•  Extensions  of  the  (Mm)  and  (LMm)  models  to  consider  system  restoration  and 
unmet  load  over  time, 

•  And,  extensions  of  the  (Mm)  and  (LMm)  models  to  incorporate  protective  measures 
(PLMm): 


{PLMm) :  min  dp  +  max  min  cy 

peP  SeA(p) 

.  [  A(p)y<B{p)8  ’ 
s.t.  < 

1  )^0 

where  the  new,  third  level  of  optimization  over  p  e  P  represents  protective 
measures  to  be  taken  in  advance.  These  measures  will  influence  the  ability  of 
terrorist  to  attack  the  grid  via  5 €  A (p) ,  and  the  subsequent  power  flows. 
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The  mathematical  modeling  and  algorithmic  details  of  our  research  to  date  are  explained  in  the 
remainder  of  this  section.  We  first  introduce  our  DC  approximation  of  the  power-flow  model., 
and  then  present  the  formulation  of  the  interdiction  model.  Finally,  we  introduce  the  algorithm 
we  use  for  approximate  solution  of  the  combined  power-flow/interdiction  model. 

3.1  Power-flow  model 

Our  present  implementation  of  a  basic  power-flow  model  is  simplified  to  the  so-called  DC 
representation  of  the  full  AC  model,  which  neglects  reactive  power  effects.  This  entails  various 
assumptions,  many  of  which  may  be  acceptable  in  the  context  of  security  analysis  [e.g.,  Wood 
and  Wollenberg  1996].  This  model,  hereafter  called  DC-OPF  (DC-Optimal  Power  Flow),  is 
specified  below.  The  objective  is  to  generate  and  distribute  energy  at  minimum  cost  while 
simultaneously  meeting  demand  as  best  possible,  at  a  single  instant  of  time.  We  later  consider  a 
time-phased  model  that  considers  the  changing  state  of  the  network  over  time  after  an  attack,  and 
accumulates  the  penalty  associated  with  unserved  demand  over  time.  In  the  eventual  max-min 
interdiction  model,  the  right-hand  sides  of  the  model’s  constraints  will  be  modified  through  a  set 
of  interdiction  variables. 

Index  sets  and  indices: 

/  set  of  buses  (i,k  denote  bus  indices) 

G,  set  of  generators  at  bus  i  ( g  denotes  a  generator) 

L  set  of  lines  ( l  denotes  a  line) 

Lt  set  of  lines  connected  to  bus  i 

C  set  of  consumer  sectors  ( c  denotes  a  consumer  sector) 

S  set  of  substations  ( s  denotes  a  consumer  sector) 

Is  set  of  buses  at  substation  s 

Ls  set  of  lines  at  substation  s  (including  transformers  and  lines  connected  to  the 

substation) 

(Remark:  In  this  model,  transformers  can  be  represented  by  lines) 

Parameters: 

o(l),d(l )  origin  and  destination  buses  of  line  /  e  L .  Remark:  More  than  one  line  with  the 
same  o(l),d(l)  may  exist. 
i(g)  bus  for  generator  g  ,  i.e.,  g  e  Gi(g) 
djc  load  demand  of  consumer  sector  c  at  bus  i 

PlLine  maximum  flow  (i.e.,  transmission  capacity)  on  line  /  e  L 
pG‘n ,  PjGgen  min  and  max  power  output  from  generator  g  at  bus  i ,  where  g  e  G, 
r,  line  resistance  for  /  e  L 

xl  line  reactance  for  /  e  L  (we  assume  x,  »  r( ). 

X 

B,  series  susceptance  for  line  le  L  ,  calculated  as  B,  =  - 

ri  +xi 


4 


4(0 


^Gen 


) 


load  shedding  cost  function  for  customer  sector  c  at  bus  i ,  e.g.,  for  a  segment 
set  H  =  {1, 2, 3} ,  take  fic(s)  =  £ aich  sh ,  where 0  <  aiel  <  CCic2  < ....  5  =  £  sh  , 

h  h 

sh>  0 ,  and  aich  are  the  incremental  shedding  cost  rates, 
generation  cost  function  for  generator  g  at  bus  i ,  where  g  e  G, 


Decision  variables: 

P°‘n  generation  from  generator  g  at  bus  i ,  where  g  €  G(- 

PtUne  power  flow  on  line  Z  e  L 

Sjc  load  shedding  of  customer  sector  c  at  bus  i 

6.  phase  angle  at  bus  i 


Formulation 


of  DC-OPF: 


min 


,s,e 


/  geGj  i  c 

S"-1  "  V 

F(P0e\S) 


subject  to: 

P,U~=B,  -0„„). 

V/sL 

(DC.l) 

EC- z  c+  z  c 

geG,-  l\o(l)=i  l\d(l)=i 

=  Z<4-s,.>.  Vi 

c 

(DC.2) 

pLine  ^  pLine  ^  pLine 

V/eL 

(DC.3) 

pGen  ✓  -pGen  ^  -pGen 
i-i,g  ~  ri,g  ri,g  ’ 

V/,Vge  Gj 

(DC.4) 

0<s„<d„, 

\/i,c 

(DC.5) 

DC-OPF  minimizes  generation  plus  shedding  costs  (penalties)  in  the  objective  function. 
Constraints  (DC.l)  approximate  active  power  flows  on  the  lines.  Current-balance  constraints  at 
the  buses  are  established  in  (DC.2).  Constraints  (DC.3)  and  (DC.4)  set  maximum  line  power 
flows  and  maximum  and  minimum  outputs  from  each  generating  unit.  (DC.5)  states  that  the  load 
shedding  cannot  exceed  demand. 

3.2  Interdiction  model 

The  interdictor  in  our  model,  i.e.,  a  group  of  terrorists,  will  make  a  coordinated  set  of  resource- 
constrained  interdictions  (attacks)  on  the  power  grid.  We  make  the  following  assumptions  on  the 
effect  of  each  potential  interdiction: 

•  Line  interdiction:  All  lines  running  physically  in  parallel  at  the  point  of  an  attack  are 
opened.  (Typically,  these  lines  are  mounted  on  the  same  towers,  and  an  attack  on  any 
one  is  an  attack  on  all.) 

•  Transformer  interdiction:  When  a  transformer  is  attacked,  the  line  representing  the 
transformer  is  opened. 

•  Generator  interdiction:  When  a  generator  is  attacked,  the  generator  is  disconnected  from 
the  grid. 
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•  Bus  interdiction:  When  a  bus  is  attacked,  all  the  lines  connected  to  the  bus  are  opened, 
which  in  turn  disconnects  all  generation  from  the  bus  and  all  loads  connected  to  the  bus. 

•  Substation  interdiction:  When  a  substation  is  interdicted,  all  the  buses  at  the  substation 
are  disconnected,  triggering  other  indirect  effects. 


Additional  sets  required: 

GjCGp  L  cL,  /  c  /  ,  5  c  S  :  set  of  interdictable  generators  at  bus  i ,  lines,  buses, 
and  substations,  respectively 

Additional  parameters  required: 

,  M^ne ,  Mfus ,  M  fJne ,  Mfm ,  Mssub :  amount  of  resource  required  to  interdict 

generator  g  e  G,  at  bus  i,line  Ie  ll ,  bus  ie  /*  and  substation  se  S* , 
respectively. 

M  total  interdiction  resource 

Interdiction  variables: 

€"  >  ^ne » 3,Bus » 3s“b :  binary  variable  that  takes  the  value  1  if  generator  g  e  G* ,  line 

Ie  L  ,  bus  i e  7  and  substation  se  S  ,  respectively,  is  interdicted,  and  is  0 
otherwise 

Formulation  of  I-DC-OPF: 

max  G{SGen ,  SLine ,  8Bus ,  8Sub ) 

' 

subject  to: 

Z  E  C"  +  +ZM- +  X  <M  (1.1) 

fe/  «6C*  /ei'  Is/*  jeS* 

SG‘n  e  {0,1},  8bme  e  {0,1},  8tBm  e  {0,1},  Sfuh  e  {0,1},  V  interdictable  elements  (1.2) 
where* 

nj.  £2>(C>+ZZ/<^>  <n>C.O) 


subject  to: 


F(/>C”,S) 


Z  C  -  Z  /!“‘+  Z  -  Z Vi 


(IDC.2) 


/lo(/)=i  IW(l)=i 


(1  -  8\ine )  <  /*“•*  <  (l  -  8bine), 


V/sL 


(IDC.3) 


(1-45)(1-C")C^C  Sa-Ol-OC’  Vt,Vg€Gf  (IDC.4) 
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0  <Sic<dic,  V  i,c  (IDC.5) 

The  solution  to  I-DC-OPF  maximizes  dismption.  Disruption  is  evaluated  through  the  inner 
minimization  problem  that  consists  of  a  power-flow  model  like  DC-OPF,  but  from  which  we 
have  removed  all  the  interdicted  elements  beforehand.  At  the  upper  level,  (1.1)  reflects  the 
terrorists’  options  to  interdict  different  combinations  of  elements  in  the  network  without 
exceeding  their  resources.  (More  complicated  interdiction-resource  constraints,  or  logical 
constraints  on  interdiction,  are  straightforward  to  incorporate.)  (1.2)  defines  each  individual 
terrorist  option  as  a  binary  variable. 

Equations  (IDC.1)-(IDC.5)  are  analogs  (DC.1)-(DC.5).  Here,  however,  the  elements  that  have 
been  (directly  or  indirectly)  interdicted  are  removed  from  the  equations  through  the  binary 
interdiction  variables.  For  example,  if  a  line  l  is  connected  to  an  interdicted  substation  s  (that  is, 

S*ub  =  1  )  then  (IDC.l)  for  line  l  becomes:  P,Lme  =  0 . 

The  computational  difficulty  of  the  I-DC-OPF  model  stems  from  the  max-min  structure  of  the 
problem.  (Constraints  (IDC.4)  can  be  linearized  and  do  not  present  a  problem.)  The  inner 
minimization  is  over  a  polytope  that  depends  on  S .  Solution  of  the  inner  minimization  problem 
as  a  linearized  function  of  S  yields  a  function  that  is  convex  in  5 .  Consequently,  the  outer 
maximization  is  over  a  convex  function,  which  (as  usual)  is  computationally  difficult. 

3.3  Interdiction  algorithm 

Future  research  will  investigate  the  conversion  of  I-DC-OPF  to  a  linear  mixed-integer  program 
which  could  be  solved  directly  or  through  decomposition  [Cormican  et  al.  1998].  At  this 
juncture,  we  have  devised  a  decomposition-based  heuristic  approach  to  obtain  good  (for  the 
terrorist)  interdiction  plans,  but  not  necessarily  optimal  ones.  The  heuristic  is  outlined  in  Figure 
1,  and  details  follow. 


Solve  the  DC-OPF  for  the  present 
grid  configuration 


A 


Based  on  present  and  previous  flow 
patterns,  assign  a  “Value”  to  each 
interdictable  asset 


Maximize  the  Value  of  the  Assets 
to  be  Interdicted  (excluding 
previously  explored  solutions) 


I 


We  begin  by  solving  DC-OPF  assuming  no  attacks.  The  result  is  an  optimal  power  flow  for 
normal  operations,  a  flow  that  typically  minimizes  generation  costs  without  shedding  any  load. 
The  power-flow  pattern  is  used  to  assign  relative  values  (see  below)  to  all  the  components  of  the 
power  grid:  generators,  lines  (and  transformers  represented  by  lines),  buses  and  substations. 
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Then,  we  maximize  the  estimated  value  of  the  assets  to  be  interdicted  while  ensuring  that  the 
resources  required  for  the  interdiction  plan  are  not  exceeded.  With  this  plan,  we  modify  the  right- 
hand  side  of  DC-OPF  model  and  obtain  its  solution.  The  result  is  a  power  flow  that  again 
minimizes  generation  costs  plus  the  penalty  associated  with  load  shedding:  It  is  likely  in  this  case 
the  some  load  will  indeed  be  shed  since  valuable  assets  (e.g.,  substations  that  were  distributing 
electricity)  have  been  removed  from  the  grid. 

The  process  continues  by  finding  alternative  sets  of  valuable  assets  to  interdict  that  have  not  been 
identified  at  earlier  iterations,  and  by  evaluating  load  shedding  for  each  of  these  interdiction 
plans.  This  algorithm  may  be  viewed  as  a  heuristic  version  of  Benders  decomposition  [Geoffrion 
1972]  to  solve  the  bilevel  program  (I-DC-OPF).  This  decomposition  incorporates  super- valid 
inequalities  to  eliminate  previously  generated  solutions  [Israeli  and  Wood  2002]. 

We  next  provide  details  of  the  two  models  required  in  the  heuristic  decomposition: 

Subproblem:  DC-OPF  for  a  specific  interdiction  plan 

Assume  that  at  iteration  t  of  our  algorithm,  a  specific  interdiction  plan 
O  -{o  ,o  ,0  ,0  )  is  given;  the  superscript  t  is  an  iteration  counter.  The 

associated  power-flow  model  DC-OPF(<5') ,  from  equations  (IDC.0)-(IDC.5),  is  the 
“subproblem”  and  its  solution  yields  objective  value  G(SGent  ,SUne'  ,SBus'  ,SSub')  along  with 

power  flows,  generation  and  unmet  demand  that  are  represented  by  P'  =  (PLine' ,PGen' , S' , O') . 
(This  vector  is  represented  by  y  in  the  generic  max-min  model  (Mm)) 

Value  specifications 

The  solution  P  =(PLme'1  ,PGen'' ,S' ,0')  provided  by  subproblem  DC-OPF(^)  serves  to 

construct  a  list  of  uninterdicted  elements  in  the  power  grid  that  is  ordered  in  terms  of  “estimated 
attractiveness”  for  further  interdiction.  To  determine  the  individual  importance  of  each  asset,  we 
define  a  set  of  parameters  which  will  represent,  essentially,  estimated  coefficients  for  a  “Benders 
cut”  that  will  be  added  to  the  master  problem.  (In  this  heuristic,  the  “cut”  is  added  to  the  master- 
problem  objective  rather  than  being  added  as  a  constraint;  the  super-valid  inequalities  give  us  the 
“cuts”  that  build  up  from  iteration  to  iteration.)  These  parameters  are: 


Into,t  __ 

E  i?~J+  E  1 

pLine,t 

ri 

(total  flow  into  bus  i) 

l\o(l)=i  l\d(l)=i 

A  P,Um  >0  A  P(Une  <0 

Out,t  __ 

E  I/M+  E 

pLine  ,t 
ri 

(total  flow  out  of  bus  i) 

/io(/)=;  /W(0=i 

A >o 

Met,t  ___ 

Ew.-4) 

C 

(total  demand  met  at  bus  i) 

t 7 Gen  pen  pGen.i 

vg  —  w  rg 


(value  of  generator  g ) 
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(value  of  line  0 

(value  of  bus  i) 

(value  of  substation  s) 

In  these  assignments,  parameters  wGen  ,wBus  ,wLme  and  wSub  are  given  as  input  data  to  reflect 
preliminary  estimates  of  value  for  each  type  of  asset.  By  default,  all  of  them  can  be  set  to  one. 
However,  computational  experience  indicates  that  the  algorithm  is  more  efficient  when  using 
values  that  provide  higher  incentives  for  attacks  on  buses  and  whole  substations  versus  individual 

lines  and  generators,  for  example,  wGen  =  2,  wBus  =  5,  wL,ne  =  1,  wSub  =  5  . 

An  extended  definition  of  value  (that  we  have  also  exercised  in  our  computations)  incorporates 
the  following  two  enhancements: 

•  The  first  modification  divides  the  above-defined  value  of  a  given  component  (given 
in  MW)  by  the  amount  of  interdiction  resources  required  to  interdict  it.  The  idea  is 
to  factor  in  not  only  the  power  flow  that  a  specific  asset  supports,  but  also  its  relative 
importance  with  respect  to  the  required  resources  to  attack  it.  This  value  is  given  in 
MW/resource  units. 

•  The  second  modification  takes  note  that  every  time  an  asset  is  interdicted,  the  power 
flow  through  it  is  null.  As  a  consequence,  the  asset  does  not  appear  as  an  attractive 
target  at  the  (immediately)  following  iteration.  To  overcome  this  mismatch,  we 
define  the  “cumulative  value”  of  a  specific  asset  as  the  average  value  of  the  asset 
throughout  the  iterations  of  the  algorithm  in  which  the  asset  was  not  interdicted. 
This,  in  turn,  allows  us  to  integrate  all  the  iterations  (instead  of  the  last  one  only) 
into  the  value  concept. 

Mathematically,  the  new  values  are  calculated  as: 


(value  of  generator  g) 


(value  of  line  l) 


(value  of  bus  i) 


(value  of  substation  s) 
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Remark:  For  the  purpose  of  calculations,  if  an  indirect  interdiction  occurs  (e.g.,  a  line  is  not 
attacked  but  it  is  connected  to  an  interdicted  bus),  we  assume  in  the  computations  above,  that  all 

o  variables  related  to  the  attacked  asset  and  to  all  the  indirectly  attacked  assets  are  set  to  one. 


Master  Problem:  Finding  the  most  valuable  interdiction 


Let  us  assume  that  a  set  of  estimated  values  for  each  element  of  the  grid, 
V'  =  {Vg’rn  ‘ >  VlLine'1 , V*”-' ,  Vfub! ) ,  has  been  calculated  at  iteration  t.  Let  us  also  define  the  vector 

of  previously  generated  interdiction  plans,  A'  =  {SX .  The  interdiction  master  problem  is 
then: 


MP(V',A'): 


I Zv?"'%r  +2;v,“»T" +£v,c""'<?,~ + 

gBusj’gSubi  ’  ,6^  |SG,  /ei.”  iel’  reS‘ 


subject  to: 

Z  Z  MU?  S?r  +z  Miine’'  Siine'‘  +ZM.fiUI''  6?m'!  +  Z  MsUh''  SsUbJ  -M  (MP.D 

fe/  jeG'  let'  iel'  seS" 

C  e  {0,1},  S“neJ  e  {0,1},  StBusJ  e  {0,1},  8**''  e  {0,1}, 

V  interdictable  elements  (MP.2) 

8?'n  <  +8Bus  '  <\,  Vge  G*,Vie  1  (MP.3) 

SUne.,+SBus,'  g  £  n£yie  J  (MP.4) 

gune.t  +  gLme,t  <  j  V/,  Z  ’€  L*  I  /,  /  ’  in  parallel  (MP.5) 

SBu,,t  +  gsub,t  <  j  Vi  e  /,  n /*, Vs e  S  (MP.6) 

^'+^•'<1,  V/eL,nL*,Vi€S  (MP.7) 

Z  Z  C+  Z  +  Z  <T''  +  Z 

fe/  geG*l  teZTl  /e/'l  jeS*l 

Sf^nJ  =1  Sf***' =i  SiBl,sr=]  SjHbJ’= ] 

V'l  A/;*.,’  ,•  x— I  Ar..u.  ...  (MP.8) 


Z  Z  4Tr+  Z  <^'  +  Z  Z  -i.  vi'<i 

iel  geG:\  tet’l  ie/‘|  reS*l 


=1 


<5)£J"/'=i 


A8’"-' =1 


<5“J=i 


The  objective  function  of  MP(v  ,  A  )  attempts  to  maximize  our  estimated  value  of  interdicted 
resources. 

Constraints  (MP.l)  and  (MP.2)  are  analogous  to  (1.1)  and  (1.2)  in  the  I-DC-OPF  model. 

(MP.3)  through  (MP.7)  serve  the  following  purposes,  respectively:  Interdict  a  generator  or  the  bus 
that  it  is  connected  to,  but  not  both;  interdict  a  line  or  the  bus  that  it  is  connected  to,  but  not  both; 
if  in  parallel,  interdict  one  line  or  another,  but  not  both;  interdict  a  bus  or  the  substation  that  it 
belongs  to,  but  not  both;  and,  interdict  a  line  or  the  substation  that  it  is  connected  to,  but  not  both. 
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Of  course,  the  reason  for  this  exclusion  is  that  the  objective  function  treats  the  different  elements 
as  individual  items  with  their  own  value  (disregarding  that  an  interdiction  may  trigger  other 
indirect  interdictions).  Thus,  these  constraints  avoid  unnecessary  use  of  resources  to  destroy 
elements  of  the  grid  that  have  been  effectively  interdicted  as  a  consequence  of  other  interdictions. 

Finally,  (MP.8)  ensures  that  the  interdiction  plan  chosen  at  the  incumbent  iteration  is  different 
from  any  other  plan  from  previous  iterations.  This  equation  is  a  little  more  restrictive  than  the 
following  alternative: 

E  Z  C"  +  Z  +  Z  S‘‘,J  +  £  <?“■' 

IE  /  pgG’|  tet'l  i'e/'I  jeS*l 

$C€«r=1  S*“!r= 1  <?“■'=  1 


-E  Z  C'-  Z  Z  Z 


(MP.8-II) 


fe/  jec;i 

s?y= o 


tetl 

S,UntJ’=o 


seS  I 

S?,bl'=o 


z  z  ^r+  z  ^ne',  +  z  +  z  -i.  vf<f 


fe/  geG,  I 
=1 


tell 

^•'=1 


fe/  I 

A®"'’*! 
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At  iteration  t ,  (MP.8-II)  deems  feasible  an  attack  consisting  of  all  of  the  attacked  elements  at  a 
previous  iteration  tf  plus  new  elements.  (MP.8)  assumes  that  no  superset  of  a  set  of  once- 
interdicted  elements  will  ever  be  interdicted,  because  we  believe  the  master  problem  will 
typically  consume  all  available  resource  in  finding  a  set  of  elements  to  interdict,  and  no  superset 
can  therefore  be  feasible.  Only  (MP.8)  has  been  tested  at  this  time. 

The  solution  to  MP(V',A')  is  denoted  S’  =  (8Gen'' , 8Unel , SBusJ , 8Sub'1 )  and  it  is  used  in  the 
subproblem  to  start  a  new  iteration  of  the  algorithm.  The  algorithm  is  described  next. 

I-ALG:  Interdiction  Algorithm 

Input  data: 

Problem  data  (grid  data,  interdiction  data) 

T  (maximum  number  of  iterations) 

Initialization: 

Set  t  =  0  (iteration  counter)  and  8°  =  (SGen’° jS1"16,0 ,SBus'° ,8Sub0)  =  (0,0,0,0)  . 
Set  8*  =  8°  and  i>*(DC-OPF)=0  (best  interdiction  plan  so-far) 

Subproblem: 

Solve  DC-OPF(£') .  Denote  its  objective  function  value  by 
V(DC-0PF(8‘)). 

If  v(DC  -  OPF (8’  ))>  V  {DC  -  OPF) ,  assign 

V  (DC-OPF)  <-  v(DC  -  OPF  (S' ))  and  8*  S' . 


Assign  t  <r-  f  + 1 .  If  t>T ,  STOP. 
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Master  problem: 

Calculate  the  vector  of  estimated  values,  V' ,  and  update  A'  =  (S',...,  S‘~'). 

Solve  MP(V',A'). 

If  MP(Vf,  A')  is  infeasible,  STOP.  Otherwise,  return  to  Subproblem. 

Output: 

ft* 

The  resulting  A  is  a  feasible  interdiction  plan  with  associated  cost  t/(SP) .  If 

the  algorithm  exits  at  the  master  problem  step  (i.e.,  MP(V',A')  is  infeasible),  it 

means  that  all  the  feasible  solutions  have  been  enumerated,  and  8‘  are  therefore 
optimal. 
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4.  RESULTS 


4.1  Implementation 

We  have  applied  the  I-ALG  algorithm  developed  in  this  research  to  two  test  networks  drawn 
from  the  1996  reliability  test  system  (RTS)  [IEEE  Reliability  Test  Data,  1999-1, 1999-11]. 

Tests  are  carried  out  on  a  1  GHz  desktop  PC  with  1GB  of  RAM.  The  I-ALG  algorithm  is 
implemented  using  GAMS  [2003].  The  subproblems  and  master  problems  are  solved  using 
CPLEX  [GAMS-CPLEX  2003]. 

We  set  a  limited  number  of  iterations,  T  =  500 ,  because  the  computational  complexity  of  the 
master  problem  increases  as  the  number  of  iterations  grows  (the  number  of  constraints  in  (MP.8) 
increases  by  one  at  every  iteration).  In  fact,  computational  experience  shows  that  little 
improvement  in  solution  quality  is  achieved  after  100  iterations,  with  the  best  solution-quality 
versus  time  tradeoff  occurring  between  50  and  100  iterations. 

4.2  Test  case  description 

The  RTS  examples  are  not  intended  to  represent  a  particular  system  but,  rather,  a  general 
reference  grid  that  contains  (to  a  certain  extent)  the  different  technologies  and  configurations  that 
exist  in  any  power  grid.  Figures  2  and  3  represent  the  RTS-One  Area,  whereas  Figure  4  is  the 
RTS-Two  Areas,  which  merges  two  areas  by  incorporating  three  interconnections. 

Labels  next  to  lines  and  buses  are  just  for  the  purpose  of  identifying  elements  as  they  appear  in 
TF.F.F.  Reliability  Test  Data  [1999-1,  1999-11],  where  more  specific  details  can  be  consulted.  The 
figures  inside  the  circles  indicate  the  number  of  generation  units  at  the  bus  and  their  maximum 
output.  (Figure  5  shows  only  the  aggregated  output.)  Next  to  each  arrow  we  specify  the  total 
load  at  the  corresponding  bus. 

In  addition  to  grid  data,  we  assume  that  terrorists  have  limited  resources  to  simultaneously 
interdict  multiple  elements  of  the  grid,  and  that  these  terrorists  will  complete  their  actions 
successfully.  For  simplicity  of  exposition,  suppose  that  the  terrorists’  resources  can  be  quantified 
as  six  people  (for  RTS  One-Area)  and  twelve  people  (for  RTS  Two-Areas),  and  that  one  person  is 
required  to  attack  any  line  (except  buried  cable  lines,  that  cannot  be  interdicted,  and  lines 
representing  transformers  that  require  two  people),  two  people  can  attack  an  individual  generator, 
and  three  people  can  attack  any  bus  or  substation  (including  the  large  substation  in  the  middle  of 
the  figure).  In  general,  the  concept  of  terrorist  “resources”  can  accommodate  the  available 
information  from  intelligence  sources,  whether  it  is  specific  as  in  this  example,  or  generic,  such  as 
“any  three  attacks  might  happen.”  Also,  for  simplicity,  we  measure  the  effect  of  a  set  of  attacks 
through  the  total  load  (demand  for  electricity)  that  must  be  shed  (left  unmet);  if  this  load  were  not 
shed  at  the  operation  control  level,  cascading  outages  and  a  complete  system  blackout  could 
occur. 

4.3  Interdiction  plans 

Our  algorithm  finds  many  attack  plans  for  RTS-One  Area,  from  which  we  choose  the  following 
two  to  look  at  more  closely:  “Plan  A”  (Figure  2)  attacks  the  substation  and  three  selected  lines, 
shedding  1,258  MW  (44.1%  of  the  total  load),  and  “Plan  B”  (Figure  3)  attacks  six  selected 
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transmission  lines,  shedding  1,373  MW  (48.2%).  Plan  B  sheds  more  instantaneous  load  than 
Plan  A,  but  we  must  estimate  the  total  amount  of  unsupplied  energy  while  the  effects  of  the  attack 
last.  Our  algorithm  I-ALG  does  not  take  this  aspect  into  consideration  yet.  Doing  so  entails 
establishing  time  lines,  or  “time  regimes,”  for  repair,  and  evaluating  the  resulting  load-shedding 
patterns  and  their  cost,  over  time.  In  our  example,  the  115  MW  of  additional  “short-term”  load 
shedding  in  Plan  B  may  be  negligible  when  compared  to  the  long-term  disruption  caused  by 
destroying  the  four  transformers  in  the  large  substation,  which  presumably  could  not  be  replaced 
or  repaired  quickly. 

Figure  4  depicts  results  for  the  RTS-Two  Areas  test  problem.  Note  that  2,516  MW  (44.1%)  of 
load  is  shed.  This  means  that  the  terrorists  can  interdict  a  bit  less  than  twice  as  much  power  by 
using  twice  as  many  terrorists  in  a  grid  that  is  “twice  as  big”  as  the  original.  The  three 
interconnection  tie  lines  (one  of  which  is  also  interdicted)  make  up  for  the  small  but  significant 
difference. 
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TFFF  RTS  (Two  Areas).  Total  Load:  5,700  MW.  Resources:  12  terrorists.  Load  Shedding:  2,516  MW. 


Figure  5  shows  the  amount  of  load  shed  in  each  grid  when  interdiction  resources  vary  from  zero  to  forty 
terrorists.  As  expected,  the  amount  of  load  shed  is  a  monotonically  non-decreasing  function  of  die 
number  of  terrorists.  Actually,  that  this  expected  result  does  occur  lends  credence  to  die  accuracy  of  our 
optimization  algorithm-  If  die  heuristic  were  poor,  we  would  expect  to  see  die  load  shed  to  drop 
occasionally  with  increased  interdiction  resources. 


Figure  5-A:  Load  shedding  for  RTS-One  Area  by  Figure  5-B:  Load  shedding  for  RTS-Two  Areas 
number  of  terrorists.  Total  load  is  2,850  MW.  by  number  of  terrorists.  Total  load  is  5,700  MW. 

The  results  is  also  compared  to  twice  the  load 
shed  in  the  One-Area  case  using  half  the  number 
of  terrorists.  _ 


Figure  5.  RTS-One  Area  and  RTS-Two  Areas  Load  shedding  for  different  interdiction  resources 

In  the  One-Area  case  we  observe  that  using  28  terrorists  or  more  results  in  at  least  90%  of  the  total  load 
being  shed  (Figure  5-A).  For  the  most  part,  the  Two-Areas  case  (Figure  5-B)  is  more  difficult  to  interdict 
when  compared  to  the  One-Area  case  for  twice  the  amount  of  interdiction  resource.  For  example,  we  can 
shed  2,311  MW  in  the  One-Area  case  using  20  terrorists,  whereas  only  4,000  MW  can  be  shed  in  the  Two- 
Area  case  using  40  terrorists.  In  this  sense,  the  interconnection  lines  play  an  important  role  in  decreasing 
the  impact  of  the  attacks.  However,  we  observe  the  opposite  effect  if  the  number  of  terrorist  is  small.  In 
this  case,  there  is  little  damage  that,  for  example,  two  terrorists  can  cause  in  the  One-Area  case. 
However,  in  comparison,  four  terrorists  may  cause  more  damage  in  the  Two- Areas  case  because  they  can 
still  focus  on  the  weak  links  of  a  single  area 
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5.  VALUE  OF  THE  RESEARCH  TO  HOMELAND  SECURITY 

The  call  for  proposals  that  this  research  addresses,  asks  how  our  research  adds  value  to  the 
Homeland  Security  effort.  We  respond  as  follows: 

Simulation  software  for  HLS: 

-  Attacks  on  critical  infrastructure:  Power  Grids 

Deliverables  (this  document): 

-  Models  and  algorithms  (as  presented) 

-  Case  studies  (as  presented) 

-  Software  (under  development) 

-  Publications  (future  work) 

By  criterion  used  to  fund  the  project: 

-  This  research  addresses  an  important  problem  in  HLS 

-  This  research  adds  to  the  body  of  HLS  knowledge 

-  This  research  is  interdisciplinary 

-  This  research  is  novel  and  useful 

-  This  research  invites  non-NPS  collaborators 

-  Pis  have  a  reputation  in  the  proposed  field  of  study 

-  Pis  will  try  to  get  students  involved  in  this  research  and  produce  theses 

-  Results  will  be  publishable 

-  Results  will  be  useful  in  teaching  HLS  courses 

-  Pis  believe  the  budget  is  in  line  with  the  expected  results 
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6.  FUTURE  WORK 


6.1  Introduction 

Many  technical  and  functional  issues  remain  for  future  work,  and  they  include: 

A)  Modeling:  Power  restoration  over  time  will  be  modeled,  along  with  short-term  and  long-term 

economic  effects.  Approximate  “load  curves”  may  be  incoiporated  as  well  as 
contingency  constraints,  losses  and/or  reactive  power  flows,  and  short-term 
commitment  issues.  The  non-convex  bilevel  models  will  be  convexified  for  solution 
via  direct  integer-programming  techniques. 

B)  Algorithms:  Optimal  branch-and-bound  solutions  must  be  compared  to  heuristically  obtained 

solutions;  “dynamic  penalties”  will  be  investigated  in  convexified  models;  and  non¬ 
heuristic  decomposition  algorithms  for  bilevel  interdiction  will  be  designed  and 
tested. 

C)  Data:  Additional  benchmark  test-system  data  are  required,  such  as  the  test  beds  available 

from  the  websites  http://www.cesac.howard.edu  and  http://www.usna.edu/EPNES  . 
We  are  attempting  to  obtain  (disguised)  data  for  real-world  power  grids  in  the  US, 
will  investigate  intelligence  reports  on  terrorist  methods  and  resources,  and  will 
identify  potential  protective  measures  and  their  costs. 

D)  Extensions:  The  bilevel  interdiction  model  will  be  extended  to  a  trilevel  “protection  model” 

that  explicitly  models  potential  system  upgrades  for  better  security.  It  will  also 
incorporate  the  market  benefits  of  such  upgrades  to  offset  the  cost  of  upgrades.  Of 
course,  algorithms  will  be  developed  to  solve  these  models. 

We  describe  some  of  this  future  work  in  more  detail,  next. 

6.2  Functionality  and  Modeling 

We  realize  that  our  current  model’s  static  representation  of  power  disruption  at  a  given  point  in 
time  does  not  fully  represent  the  consequences  of  a  terrorist  attack.  The  inaccuracy  of  this 
approximation  depends  on  two  major  factors: 

1)  Variability  in  the  repair  times  of  damaged  system  components,  and  to  a  lesser  degree, 

2)  Daily  and  weekly  variability  in  demand. 

The  two  interdiction  plans  A  and  B  (shown  in  Figures  2  and  3,  respectively)  demonstrate  the  first 
factor.  Plan  A  (attacking  the  substation  and  three  selected  lines)  results  in  less  instantaneous 
load-shedding  than  Plan  B  (attacking  six  selected  lines).  However,  can  the  latter  be  considered 
the  worst-case  scenario?  In  order  to  answer  this  question,  we  must  estimate  the  total  amount  of 
unsupplied  energy  while  the  effects  of  the  attack  last.  This  entails  establishing  time  lines,  or 
“time  regimes,”  for  repair,  and  evaluating  the  resulting  load-shedding  patterns,  or  their  cost,  over 
time,  as  represented  in  Figure  6. 
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MW  shed 


Following  up  on  the  question  as  to  whether  Plan  B  was  actually  more  disruptive  than  Plan  A  in 
Figure  1,  we  may  no  longer  be  sure  that  this  is  the  case.  The  115  MW  of  additional  “short-term” 
load  shedding  in  Plan  B  might  be  negligible  when  compared  to  the  long-term  disruption  caused 
by  destroying  the  four  transformers  at  the  large  substation.  This  example  shows  the  need  to 
include  repair  time  as  a  decisive  component  of  the  interdiction  problem. 

We  may  also  enhance  some  technical  aspects  of  the  basic  power-flow  model.  For  example,  our 
present  implementation  of  this  model  does  not  represent  contingency  constraints  and  disregards 
reactive  power  flows,  which  may  be  particularly  important  in  cases  where  reactive  support  at 
substations  has  been  disabled  as  part  of  an  attack  on  a  substation.  (Contingency  constraints 
require  that  the  grid  be  operated  in  such  a  way  that  no  single  failure  will  cause  any  load  to  be 
shed.)  This  entails  various  assumptions,  many  of  which  may  be  acceptable  in  the  context  of 
security  analysis  [Wood  and  Wollenberg  1996],  but  more  precise  modeling  may  be  necessary. 

6.3  Algorithms 

Keeping  pace  with  the  modeling  work,  new  effort  is  required  to  improve  the  computational 
efficiency  of  the  algorithms  developed  to  solve  those  models.  As  is  normally  the  case  in  large- 
scale  models,  we  must  find  a  compromise  between  model  accuracy  and  tractability.  And,  of 
course,  the  extent  to  which  we  can  rely  on  exact  methodologies  will  depend  on  how  we  aggregate 
levels  of  decisions  and  incorporate  new  modeling  features.  Mathematically,  we  also  need  to 
characterize  exact  optimality,  or  find  tight  bounds  on  maximum  error. 

As  an  example  of  the  research  to  be  carried  out  here,  we  note  that  our  basic  min-max  model 
(Mm),  after  proper  linearization,  can  be  converted  to: 

max  mincy  +  <5rBrP5 

SeA 

J  Ay  <  Is 
s.t.< 

\y,s>0 
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where  P  is  a  diagonal  matrix  of  penalties  which  represent  upper  bounds  on  dual  variables 
[Morton  and  Wood  1999].  The  inner  minimization  is  now  a  concave  problem  in  S  and  can  be 
readily  solved:  The  model  can  be  converted  to  a  mixed-integer  program  and  solved  directly,  if  it 
is  not  too  large.  (Note:  The  conversion  just  described  is  typically  referred  to  as 
“convexification,”  although  it  is  actually  “concavification”  in  this  case.) 

However,  the  penalties  represented  by  P  are  not  easy  to  define  in  this  complicated  power-flow 
situation:  If  they  are  too  large  the  model  will  be  difficult  to  solve;  and  if  they  are  too  small,  an 
incorrect  solution  will  obtained,  perhaps  with  no  indication  that  it  is  incorrect  [Israeli  and  Wood 
2002],  We  will  pursue  the  topic  of  “dynamic  penalties”  where  small  initial  penalties  are  defined 
and  are  increased  within  the  branch-and-bound  algorithm,  as  needed. 

6.4  Data 

Our  current  and  future  interdiction  models  and  algorithms  must  be  tested  using  data  derived  from 
real-world  systems.  An  important  effort  must  be  devoted  to  obtaining  such  data  from  our 
contacts  in  the  electrical  power  industry  and  to  carrying  out  this  testing.  We  realize  that  this  task 
may  not  be  easy,  and  anticipate  that  many  utilities  will  be  reluctant  to  provide  this  information  if 
our  work  is  ultimately  going  to  be  disclosed  publicly.  Initial  discussion  with  representatives  of 
Reliant  Energy  in  Houston,  Texas  indicates  that  such  concerns  do,  indeed,  exist. 


6.5  Extensions 

In  addition  to  physical  data  of  real  systems  in  the  US,  we  need  to  collect  information  on  plausible 
terrorist  attacks,  as  well  as  initiate  our  research  on  protective  systems  by  identifying  and 
gathering  data  on  actions  that  can  be  taken  to  increase  security  (e.g.,  maintaining  spare 
transformers,  hardening  substations,  etc.)  and  their  costs. 

Learning  the  best  way  to  attack  electric  grids  allows  us  to  better  analyze  how  to  defend  them. 
However,  the  first  difficulty  here  is  to  determine  a  realistic  set  of  protective  measures,  or 
“measure  types”  for  consideration,  from  which  our  optimization  analysis  can  recommend  a 
specific  of  actions  to  undertake. 

Mathematically,  this  entails  adding  a  third  level  in  the  hierarchy  of  decisions  to  be  made: 

min  dp  +  max  min  cy 

peP  SeA(p) 

f A(p)y<B(p)S 
s.t.  < 

1  y*0 

In  the  above  model,  pG  P  represents  the  set  of  feasible  protective  measures,  whose  cost  is 
represented  by  d.  Accordingly,  terrorist  will  determine  their  strategy,  S  £  A(p) ,  and  the 

(improved)  electric  system  will  calculate  optimal  power  flows  and  load-shedding  patterns  after 
the  attack 

The  plausibility  of  implementing  different  protective  measures  depends  on  the  extent  to  which 
governments,  utilities  and  consumers  are  willing  to  bear  the  costs  of  all  or  part  of  these  measures. 


22 


In  general,  expensive  protective  measures  are  unattractive  when  threats  are  deemed  low,  but  such 
measures  may  make  sense  from  the  perspective  of  national  security .  Our  ultimate  goal  is  still  to 
analyze  how  best  to  improve  the  grid  reliability,  but  we  must  explore  reasonable  tradeoffs 
between  security  and  cost. 

How  do  we  make  the  costs  of  improving  security  more  palatable?  In  many  parts  of  the  United 
States  today,  a  restructuring  of  the  electricity  industry  has  led  to  an  increased  role  of  wholesale 
markets  for  electricity.  An  important  ingredient  of  successful  electricity  markets  is  the 
availability  of  transmission  to  allow  various  generation  resources  to  compete  to  sell  energy.  The 
transmission  capability  necessary  for  a  vibrant  market  is  typically  more  than  was  required  in  the 
pre-restructured  industry;  however,  in  most  jurisdictions  there  has  been  little  new  transmission 
construction  in  the  last  decade.  Enhanced  transmission  capability  may  be  able  to  deliver  both 
increased  security  under  an  attack  scenario  and  also  greater  access  by  competitors  under  normal 
conditions.  If  such  benefits  can  be  reasonably  quantified,  then  they  can  be  incorporated  as  an 
offset  against  the  cost  of  transmission  upgrades  for  security  enhancement.  We  plan  to  incorporate 
market  effects  in  our  models  at  a  later  date. 
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Appendix:  Tables  of  Results 

TF.F.F.  RTS-One  Area  (Plan  B).  Total  Load:  2,850  MW.  Resources:  6  terrorists. 
Load  Shedding:  1,373  MW _ _ _ _ _ 


Worst  Shedding  case:  DCOPF  after  interdiction  of: 

Line:  All 
Line:  A18 
Line:  A20 
Line:  A21 
Line:  A25-1 
Line:  A25-2 
Line:  A27 
Line:  A33-1 
Line:  A33-2 


(indirect  interdiction) 

(indirect  interdiction) 
(indirect  interdiction) 


Bus  Phase  Gen.  Gen.  Load  Load  Gen.  Shed  Line  Flow  Flow  Line  Flow  Flow 

name  angle  name  (MW)  met  shed  <$/h)  (S/h)  name  from  (MW)  name  to  (MW) 


(All) 

192 

108 

0 

6632 

101U20- 

20 

2100 

101U20- 

20 

2100 

101U76- 

76 

1216 

101U76- 

76 

1216 

(All  flow  in) 
A1  102 


(All  flow  out)  136 
A2  103  7 
A3  105  128 


(All) 

192 

28 

69 

6632 

102U20- 

20 

2100 

102U20- 

20 

2100 

102U76- 

76 

1216 

102U76- 

76 

1216 

(All  flow  in) 


(All 

flow  out) 

164 

A1 

101 

52 

A4 

104 

46 

A5 

106 

66 

-3.03  (All)  0  0 


(All  flow  in) 
A2  101 

A7  124 


(All  flow  out) 
A6  109 


-5.22  (All)  0  0 


(All  flow  in) 
A4  102 


(All  flow  out) 
A8  109 


-8.74  (All)  0  71 


(All  flow  in) 
A3  101 


(All  flow  out) 
A9  110 


-9.39  (All)  0  0 


(All  flow  in) 
A5  102 


(All  flow  out) 
A10  110 


(All) 

125 

125 

0 

6875 

107U100 

80 

4400 

107U100 

0 

0 

107U100 

45 

2475 

(All) 

0 

171 

0 

0 

(All  flow  in) 


(All  flow  in) 
A12-1  109 
A13-2  110 


(All  flow  out) 


(All  flow  out) 


25 


109 

-8.16 

(All) 

0 

0 

175 

0 

175000 

(All 

flow 

in) 

142 

A6 

103 

70 

A8 

104 

46 

A14 

111 

25 

(All 

flow 

out) 

142 

A12-1 

108 

104 

A15 

112 

38 

110 

-11.82 

(All) 

0 

195 

0 

0 

0 

(All 

flow 

in) 

262 

A9 

105 

57 

A10 

106 

66 

A16 

111 

101 

A17 

112 

38 

(All 

flow 

out) 

67 

A13-2 

108 

67 

111 

-6.96 

(All) 

0 

0 

0 

0 

0 

(All 

flow 

in) 

126 

A19 

114 

126 

(All 

flow 

out) 

126 

A14 

109 

25 

A16 

110 

101 

112 

-9.99 

(All) 

0 

0 

0 

0 

0 

(All 

flow 

in) 

38 

A15 

109 

38 

(All 

flow 

out) 

38 

A17 

110 

38 

113 

0.00 

(All) 

0 

265 

0 

0 

0 

113U197 

0 

0 

113U197 

0 

0 

113U197 

0 

0 

(All 

flow 

in) 

265 

A22 

123 

265 

(All 

flow 

out) 

0 

114 

-3.88 

(All) 

0 

0 

194 

0 

194000 

114SC 

0 

0 

(All 

flow 

in) 

126 

A23 

116 

126 

(All 

flow 

out) 

126 

A19 

111 

126 

115 

1.91 

(All) 

215 

0 

317 

5915 

317000 

115U12- 

12 

780 

115U12- 

12 

780 

115U12- 

12 

780 

115U12- 

12 

780 

115U12- 

12 

780 

115U155 

155 

2015 

(All 

flow 

in) 

0 

(All 

flow 

out) 

215 

A24 

116 

152 

A26 

124 

63 

116 

0.41 

(All) 

155 

0 

100 

2015 

100000 

116U155 

155 

2015 

(All 

flow 

in) 

152 

A24 

115 

152 

(All 

flow 

out) 

307 

A23 

114 

126 

A28 

119 

181 

117 

1.01 

(All) 

0 

0 

0 

0 

0 

(All 

flow 

in) 

124 

A3  0 

122 

124 

(All 

flow 

out) 

124 

A29 

118 

124 

118 

0.00 

(All) 

0 

333 

0 

0 

0 

118U400 

0 

0 

(All 

flow 

in) 

333 

A29 

117 

124 

A31- 

1  121 

105 

A31- 

2  121 

105 

(All 

flow 

out) 

0 

26 


119 

-2.02 

(All) 

0 

181 

0 

0 

0 

(All 

flow 

in) 

181 

A28 

116 

181 

(All  flow 

out) 

0 

120 

-2.02 

(All) 

0 

0 

12  8 

0 

128000 

(All 

flow 

in) 

0 

(All  flow 

out) 

0 

121 

1.58 

(All) 

33 

0 

0 

231 

0 

121U400 

33 

231 

(All 

flow 

in) 

176 

A3  4 

122 

176 

(All  flow 

out) 

209 

A3 1-1  118 

105 

A31-2  118 

105 

122 

8.58 

(All) 

300 

0 

0 

150 

0 

122U50- 

50 

25 

122U50- 

50 

25 

122U50- 

50 

25 

122U50- 

50 

25 

122U50- 

50 

25 

122U50- 

50 

25 

(All 

flow 

in) 

0 

(All  flow 

out) 

300 

A3  0  117 

124 

A3 4  121 

176 

123 

13.42 

(All) 

265 

0 

0 

3445 

0 

123U155 

110 

1430 

123U155 

155 

2015 

123U350 

0 

0 

(All 

flow 

in) 

0 

(All  flow 

out) 

265 

A22  113 

265 

124 

0.00 

(All) 

0 

0 

0 

0 

0 

(All 

flow 

in) 

63 

A2  6 

115 

63 

(All  flow 

out) 

63 

A7  103 

63 

Totals: 

Gen. 

1477 

1477 

1373 

31895 

1.4E+6 

flow 

in 

2522 

flow  out 

2522 

TF.FF.  RTS-Two  Areas.  Total  Load:  5,700  MW.  Resources:  12  terrorists. 
Load  Shedding:  2,516  MW _ _ 

Worst  Shedding  case:  DCOPF  after  interdiction  of: 


Line : 

A18 

(indirect 

interdiction) 

Line: 

A2  0 

Line : 

A21 

Line: 

A25-1 

Line : 

A25-2 

(indirect 

interdiction) 

Line : 

A27 

Line: 

A3  3-1 

Line : 

A33-2 

(indirect 

interdiction) 

Line : 

B18 

(indirect 

interdiction) 

Line : 

B20 

Line: 

B21 

Line : 

B25-1 

(indirect 

interdiction) 

Line : 

B25-2 

Line: 

B27 

Line: 

B30 

Line : 

B33-1 

Line : 

B33-2 

(indirect 

interdiction) 

Line: 

B34 

(indirect 

interdiction) 

Line: 

AB2 

Bus  Phase  Gen.  Gen.  Load  Load  Gen.  Shed  Line  Flow  Flow  Line  Flow  Flow 

name  angle  name  (MW)  met  shed  ($/h)  ($/h)  name  from  (MW)  name  to  (MW) 


(All) 

192 

0 

108  6632  108000 

101U20- 

20 

2100 

101U20- 

20 

2100 

101U76- 

76 

1216 

101U76- 

76 

1216 

(All  inflow) 


27 


A1 

102 

8 

(All 

outflow) 

200 

A2 

103 

87 

A3 

105 

113 

102 

1.83 

(All) 

192 

0 

97 

6632 

97000 

102U20- 

20 

2100 

102U20- 

20 

2100 

102U76- 

76 

1216 

102U76- 

76 

1216 

(All 

inflow) 

0 

(All 

outflow) 

192 

A1 

101 

8 

A4 

104 

116 

A5 

106 

68 

103 

-9.46 

(All) 

0 

0 

180 

0 

180000 

(All 

inflow) 

87 

A2 

101 

87 

(All 

outflow) 

87 

A6 

109 

5 

A7 

124 

82 

104 

-7.15 

(All) 

0 

74 

0 

0 

0 

(All 

inflow) 

116 

A4 

102 

116 

(All 

outflow) 

42 

A8 

109 

42 

105 

-4.11 

(All) 

0 

71 

0 

0 

0 

(All 

inflow) 

113 

A3 

101 

113 

(All 

outflow) 

42 

A9 

110 

42 

106 

-6.21 

(All) 

0 

64 

72 

0 

72000 

(All 

inflow) 

68 

A5 

102 

68 

(All 

outflow) 

4 

A10 

110 

4 

107 

7.29 

(All) 

240 

0 

125 

13200 

125000 

107U100 

80 

4400 

107U100 

80 

4400 

107U100 

80 

4400 

(All 

inflow) 

0 

(All 

outflow) 

240 

All 

108 

175 

AB1 

203 

65 

108 

0.75 

(All) 

0 

0 

171 

0 

171000 

(All 

inflow) 

175 

All 

107 

175 

(All 

outflow) 

175 

A12-: 

l  109 

104 

A13-: 

2  110 

71 

109 

-9.79 

(All) 

0 

175 

0 

0 

0 

(All 

inflow) 

186 

A6 

103 

5 

A8 

104 

42 

A12-: 

1  108 

104 

A15 

112 

35 

(All 

outflow) 

11 

A14 

111 

11 

110 

-6.38 

(All) 

0 

0 

195 

0 

195000 

(All 

inflow) 

117 

A9 

105 

42 

A10 

106 

4 

A13- 

2  108 

71 

(All 

outflow) 

117 

A16 

111 

82 

A17 

112 

35 

111 

-10.31 

(All) 

0 

0 

0 

0 

0 

(All 

inflow) 

93 

A14 

109 

11 

A16 

110 

82 

(All 

outflow) 

93 

A19 

114 

93 

28 


-8.08  (All) 


(All  inflow) 
A17  110 


(All  outflow) 
A15  109 


0.00  (All)  t 
113U197 
113U197 
113U197 


(All  inflow) 
A22  123 


(All  outflow) 


-12.58  (All) 
114SC 


0  194000 
0 


(All  inflow) 
A19  111 


(All  outflow) 
A23  116 


-15.92  (All) 

115U12- 

115U12- 

115U12- 

115U12- 

115U12- 

115U155 


(All  inflow) 
A24  116 

A26  124 


(All  outflow) 


-15.73  (All) 

116U155 


0.99  (All)  0 


0  2015 

2015 


(All  inflow) 
A23  114 


(All  inflow) 
A30  122 


(All  outflow) 
A24  115 

A28  119 


(All  outflow) 
A29  118 


0.00  (All)  33 

118U400  33 


(All  inflow) 
A29  117 

A31-1  121 
A3 1-2  121 


(All  outflow) 


119  -17.45  (All)  0  0 


(All  inflow) 
A28  116 


(All  outflow) 
A32-1  120 
A32-2  120 


-18.93  (All) 


(All  inflow) 
A3  2-1  119 
A32-2  119 


(All  outflow) 


1.35  (All) 

121U400 


0  0 
0 


(All  inflow) 
A34  122 


(All  outflow) 
A31-1  118 
A31-2  118 


8.43  (All)  300 

122U50-  50 

122U50-  50 

122U50-  50 


29 


122U50- 

122U50- 

122U50- 


50 

50 

50 


25 

25 

25 


(All 

inflow) 

0 

(All 

outflow) 

300 

A30 

117 

121 

A3  4 

121 

179 

123 

13.42 

(All) 

0 

0 

0 

0 

0 

123U155 

0 

0 

123U155 

0 

0 

123U350 

0 

0 

(All 

inflow) 

265 

AB3 

217 

265 

(All 

outflow) 

265 

A22 

113 

265 

124 

-13.43 

(All) 

0 

0 

0 

0 

0 

(All 

inflow) 

82 

A7 

103 

82 

(All 

outflow) 

82 

A26 

115 

82 

201 

2.94 

(All) 

192 

0 

108 

6632 

108000 

201U20- 

20 

2100 

201U20- 

20 

2100 

201U76- 

76 

1216 

201U76- 

76 

1216 

(All 

inflow) 

0 

(All 

outflow) 

192 

B1 

202 

77 

B2 

203 

16 

B3 

205 

99 

202 

2.29 

(All) 

192 

97 

0 

6632 

0 

202U20- 

20 

2100 

202U20- 

20 

2100 

202U76- 

76 

1216 

202U76- 

76 

1216 

(All 

inflow) 

77 

B1 

201 

77 

(All 

outflow) 

172 

B4 

204 

76 

B5 

206 

96 

203 

0.88 

(All) 

0 

0 

180 

0 

180000 

(All 

inflow) 

81 

B2 

201 

16 

AB1 

107 

65 

(All 

outflow) 

81 

B6 

209 

63 

B7 

224 

18 

204 

-3.58 

(All) 

0 

74 

0 

0 

0 

(All 

inflow) 

76 

B4 

202 

76 

(All 

outflow) 

2 

B8 

209 

2 

205 

-2.21 

(All) 

0 

0 

71 

0 

71000 

(All 

inflow) 

99 

B3 

201 

99 

(All 

outflow) 

99 

B9 

210 

99 

206 

-9.02 

(All) 

0 

136 

0 

0 

0 

(All 

inflow) 

136 

B5 

202 

96 

BIO 

210 

40 

(All 

outflow) 

0 

207 

-1.32 

(All) 

240 

125 

0 

13200 

0 

207U100 

80 

4400 

207U100 

80 

4400 

207U100 

80 

4400 

(All 

inflow) 

0 

(All 

outflow) 

115 

Bll 

208 

115 

208 

-5.62 

(All) 

0 

115 

56 

0 

56000 

(All 

inflow) 

134 

30 


Bll 

207 

115 

B12-1 

209 

19 

(All 

outflow) 

19 

B13-2 

210 

19 

209 

-3.68 

(All) 

0 

0 

175 

0 

175000 

(All 

inflow) 

64 

B6 

203 

63 

B8 

204 

2 

(All 

outflow) 

64 

B12-1 

208 

19 

B14 

211 

5 

B15 

212 

40 

210 

-7.56 

(All) 

0 

195 

0 

0 

0 

(All 

inflow) 

235 

B9 

205 

99 

B13-2 

208 

19 

B16 

211 

76 

B17 

212 

40 

(All 

outflow) 

40 

B10 

206 

40 

211 

-3.90 

(All) 

0 

0 

0 

0 

0 

(All 

inflow) 

76 

B14 

209 

5 

B19 

214 

71 

(All 

outflow) 

76 

B16 

210 

76 

212 

-5.62 

(All) 

0 

0 

0 

0 

0 

(All 

inflow) 

40 

B15 

209 

40 

(All 

outflow) 

40 

B17 

210 

40 

213 

-13.42 

(All) 

0 

265 

0 

0 

0 

213U197 

0 

0 

213U197 

0 

0 

213U197 

0 

0 

(All 

inflow) 

265 

B22 

223 

265 

(All 

outflow) 

0 

214 

-2.16 

(All) 

0 

0 

194 

0 

194000 

214SC 

0 

0 

(All 

inflow) 

71 

B23 

216 

71 

(All 

outflow) 

71 

B19 

211 

71 

215 

-0.56 

(All) 

215 

317 

0 

5915 

0 

215U12- 

12 

780 

215U12- 

12 

780 

215U12- 

12 

780 

215U12- 

12 

780 

215U12- 

12 

780 

215U155 

155 

2015 

(All 

inflow) 

102 

B24 

216 

84 

B26 

224 

18 

(All 

outflow) 

0 

216 

0.27 

(All) 

155 

0 

100 

2015 

100000 

216U155 

155 

2015 

(All 

inflow) 

0 

(All 

outflow) 

155 

B23 

214 

71 

B24 

215 

84 

217 

24.86 

(All) 

0 

0 

0 

0 

0 

(All 

inflow) 

265 

B29 

218 

265 

(All 

outflow) 

265 

AB3 

123 

265 

218 

27.03 

(All) 

198 

333 

0 

1386 

0 

218U400 

198 

1386 

(All 

inflow) 

400 

B31- 

1  221 

200 

B31- 

2  221 

200 

31 


(All  outflow) 

265 

B29  217 

265 

219 

0.27 

(All) 

0 

0 

181 

0 

181000 

(All  inflow) 

0 

(All  outflow) 

0 

220 

0.27 

(All) 

0 

0 

128 

0 

128000 

(All  inflow) 

0 

(All  outflow) 

0 

221 

30.05 

(All) 

400 

0 

0 

2800 

0 

221U400 

400 

2800 

(All  inflow) 

0 

(All  outflow) 

400 

B31-1  218 

200 

B31-2  218 

200 

222 

0.00 

(All) 

0 

0 

0 

0 

0 

222U50- 

0 

0 

222U50- 

0 

0 

222U50- 

0 

0 

222U50- 

0 

0 

222U50- 

0 

0 

222U50- 

0 

0 

(All  inflow) 

0 

(All  outflow) 

0 

223 

0.00 

(All) 

265 

0 

0 

3445 

0 

223U155 

110 

1430 

223U155 

155 

2015 

223U350 

0 

0 

(All  inflow) 

0 

(All  outflow) 

265 

B22  213 

265 

224 

0.00 

(All) 

0 

0 

0 

0 

0 

(All  inflow) 

18 

B7  203 

18 

(All  outflow) 

18 

B26  215 

18 

Totals : 

Gen. 

3184 

3184 

2516 

76800 

2.5E+6 

Inflow 

4893 

Outflow 

4893 

32 


Initial  Distribution  List 


1 .  Research  Office  (Code  09) . 1 

Naval  Postgraduate  School 

Monterey,  CA  93943-5000 

2.  Dudley  Knox  Library  (Code  013) . 2 

Naval  Postgraduate  School 

Monterey,  CA  93943-5002 

3 .  Defense  Technical  Information  Center . 2 

8725  John  J.  Kingman  Rd.,  STE  0944 

Ft.  Belvoir,  VA  22060-6218 

4.  Richard  Mastowski  (Editorial  Assistant) . 2 

Department  of  Operations  Research 

Naval  Postgraduate  School 
Monterey,  CA  93943 

5.  Darrell  Darnel . 3 

U.S.  Department  of  Justice 

Office  of  Justice  Programs 
810  Seventh  St.,  NW 
Washington,  DC  20531 
damelld  @ojp.usdoj  .gov 

6.  Paul  Stockton,  Code  04  . 1 

Department  of  Operations  Research 

Naval  Postgraduate  School 
Monterey,  CA  93943 
pstockton  @ojp.usdoj  .gov 

7.  Ted  Lewis,  Code  CS/Lt . 1 

Department  of  Computer  Science 

Naval  Postgraduate  School 
Monterey,  CA  93943-5118 

8.  Javier  Salmeron,  Code  OR/Sa . 3 

Department  of  Operations  Research 

Naval  Postgraduate  School 
Monterey,  CA  93943 

9.  Kevin  Wood,  Code  OR/Wd . 3 

Department  of  Operations  Research 

Naval  Postgraduate  School 
Monterey,  CA  93943 

10.  Ross  Baldick . 3 

Department  of  Electrical  Engineering 

University  of  Texas  at  Austin 
Austin,  TX,  78712-1084 


33 


